Business Groups Push 10-Year Cyber Law Renewal

Thirty-five groups want the threat-sharing law extended in the fiscal 2027 defense bill, which the House includes and the Senate does not.

Updated on Nov. 2, 2026 in Cybersecurity

Business Groups Push 10-Year Cyber Law Renewal

Thirty-five business groups, led by the Business Roundtable, have asked congressional armed services leaders to renew the Cybersecurity Information Sharing Act of 2015 for 10 years through the fiscal 2027 National Defense Authorization Act. The law is set to expire again on December 11, 2026. This is an announced legislative request, not an enacted change.

Why it matters

The letter argues that AI systems can find and exploit software vulnerabilities at machine speed, shrinking the window between discovery and attack. Congress has so far renewed the law only through short-term extensions and lapses since its previous 10-year sunset.

The request is a 35-group coalition letter, a documented signatory count rather than a measured technical result. The House version of the fiscal 2027 defense bill includes the 10-year extension, while the Senate version does not, and the final outcome remains unsettled.

The players

Business Roundtable

A association of large U.S. company chief executives that led the letter urging a 10-year renewal of CISA 2015.

Rand Paul

Senator and chairman of the Senate Homeland Security and Governmental Affairs Committee, who has objected to long-term CISA 2015 extensions in the defense bill.

The details

CISA 2015 is a federal law that lets companies share cyber threat information with government agencies and with each other, with legal protections meant to encourage that sharing. The letter's signatories include the Chamber of Commerce, the Business Roundtable, and groups representing aviation, telecommunications, and technology. The request is being pursued through the annual National Defense Authorization Act, the must-pass defense bill that usually finalizes at the end of one calendar year or the start of the next.

Dec. 11, 2026: CISA 2015 is set to expire again.
Sunday before Nov. 2, 2026: Business groups sent the letter to armed services leaders.
2027: A possible committee leadership shuffle could change the outlook for the law.

The Tech Race

CISA 2015 is the statute that structures how private companies share threat data with federal agencies, and this renewal fight is playing out in the same defense bill that the House and Senate are negotiating. The coalition's argument ties that legal framework to a new, AI-driven pace of attacks.

If renewed, the law would keep the current legal framework for companies sharing cyber threat information with the government in place. Whether the 10-year term is adopted, or Congress falls back on another short-term extension, remains unsettled.

The takeaway

The renewal's outcome depends on whether the final fiscal 2027 defense bill keeps the House's 10-year extension or adopts the Senate's approach. Watch the defense-bill conference negotiations ahead of the Dec. 11, 2026 expiration.

What happens next

The final fiscal 2027 National Defense Authorization Act negotiations will determine whether the 10-year CISA 2015 extension is included before the law expires on Dec. 11, 2026.